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DETAILED ACTION 

1 . This office action is in response to the RCE filed 07/12/05. 

2. Claims 1 , 34 and 55 were amended. 

3. Claims 65-68 were added. 

4. Claims 5, 11, 16, 37 and 60 are canceled. 

5. Claims 1-4, 6-10, 12-15, 17-36, 38-59 and 61-68 are pending in this office action. 

Response to Amendment 

6. Applicant's arguments filed 7/12/05 have been fully considered but they are not 
persuasive. See 'Response to Arguments 1 . 

7. The rejection of Claim 1 under 35 U.S.C. 112, first paragraph, is withdrawn. 

8. The rejection of Claim 1 and 34 under 35 U.S.C. 112, second paragraph, is 
withdrawn. 

9. The remaining grounds of rejection are respectfully maintained as set forth in the 
office action mailed 04/1 2/05. 

Claim Rejections - 35 USC §112 

10. The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

1 1 . Claim 1 rejected under 35 U.S.C. 112, second paragraph, as being indefinite for 
failing to particularly point out and distinctly claim the subject matter which applicant 
regards as the invention. 
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12. Claim 1 recites the limitation "the preselected criterion" in line 8. There is 
insufficient antecedent basis for this limitation in the claim. 



Claim Rejections - 35 USC § 102 

1 3. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

14. Claims 34-35, 38-39, 44, 47-50, 52-55, 57, 58 and 61-64 are rejected under 35 
U.S.C. 102(e) as being anticipated by U.S. Patent 6,266,664 by Russell-Falla et al. 
(Russell-Falla). 

15. With respect to Claim 34, Russell-Falla teaches a method for monitoring and 
maintaining an acceptable use policy for computer network usage (Col. 1 lines 26-34) 
comprising: 

capturing data on a network (Col. 4 line 61 - Col. 5 line 4) wherein the data 
comprises multiple half sessions of TCP/IP communications (It is inherent that any network 
communication data on a network such as the Internet/Web -Col. 4 line 61 - Col. 5 line 21 
and Col. 1 lines 37-45 - would comprise multiple half sessions of TCP/IP communications); 

removing data content that does not contain language elements (Col. 5 lines 5-11); 



Application/Control Number: 09/759,089 Page 4 

Art Unit: 2155 

testing the remaining content for the presence of predetermined expressions (Col. 5 
lines 5-11) wherein the predetermined expressions comprise two or more categories (Col. 4 
lines 45-60 and Col. 9 lines 9-12) each containing predetermined expressions that are 
defined by a user (Col. 4 lines 4-13 and Col. 6 lines 49-64 and Col. 7 lines 16-29); 

maintaining a sum of values associated with said predetermined expressions found 
within at least one category (Col. 3 line 65 - Col. 4 line 3); 

storing the remaining data if the sum of values associated with said predetermined 
expressions within a category meets or exceeds a threshold value (Col. 5 lines 47-64 and 
Col. 6 lines 29-34). 

16. With respect to Claim 35, Russell-Falla teaches all the limitations of Claim 34 and 
further teaches the computer network is a wide area network (Col. 1 lines 37-45 of Russell- 
Falla). 

17. With respect to Claim 38, Russell-Falla teaches all the limitations of Claim 34 and 
further teaches said expressions are weighted (Col. 3 lines 55-67 of Russell-Falla). 

18. With respect to Claim 39, Russell-Falla teaches all the limitations of Claim 38 and 
further teaches said expressions are weighted with either positive or negative values (Col. 3 
line 60 - Col. 4 line 3 of Russell-Falla). 

19. With respect to Claim 44, Russell-Falla teaches all the limitations of Claim 34 and 
further teaches said expressions are regular expressions (Col. 3 lines 1-6 of Russell-Falla). 

20. With respect to Claim 47, Russell-Falla teaches all the limitations of Claim 35 and 
further teaches said threshold value for a category is variable (Col. 5 lines 47-63 of Russell- 
Falla). 
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21 . With respect to Claim 48, Russell-Falla teaches all the limitations of Claim 48 and 
further teaches outputting a report relating to the presence of predetermined expressions 
(Col. 6 lines 29-34 of Russell-Falla). 

22. With respect to Claim 49, Russell-Falla teaches all the limitations of Claim 48 and 
further teaches said report identifies individuals whose use of the computer network 
included communications which matched predetermined expressions (Col. 6 line 29-34, 
note the functionality of the report in Russell-Falla is tied to a user - Col. 6 lines 15-21 of 
Russell-Falla). 

23. With respect to Claim 50, Russell-Falla teaches all the limitations of Claim 48 and 
further teaches said report identifies network addresses where communications were 
received or originated that included matched predetermined expressions (Col. 6 lines 29-34 
of Russell-Falla). 

24. With respect to Claim 52, Russell-Falla teaches all the limitations of Claim 50 and 
further teaches said report is in a graphical format (Col. 9 lines 1-8 of Russell-Falla). 

25. With respect to Claim 53, Russell-Falla teaches all the limitations of Claim 48 and 
further teaches said report provides the text of all communications that match said 
preselected criterion (Col. 6 lines 29-34 of Russell-Falla). 

26. With respect to Claim 54, Russell-Falla teaches all the limitations of Claim 48 and 
further teaches said report is human readable format (Col. 6 lines 29-34 of Russell-Falla). 

27. With respect to Claim 55, Russell-Falla teaches a method for monitoring and 
maintaining an acceptable use policy for computer network usage (Col. 1 lines 26-34) 
comprising: 

capturing TCP/IP data on a network (Col. 4 line 61 - Col. 5 line 4); 
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removing data content that does not contain language elements (Col. 5 lines 5-11); 

defining categories (Col. 4 lines 45-67) with weighted predetermined expressions 
(Col. 3 lines 36-51) wherein the predetermined expressions are defined by a user (Col. 4 
lines 4-1 3 and Col. 6 lines 49-64 and Col. 7 lines 16-29); 

testing the remaining content for the presence of predetermined expressions (Col. 5 
lines 5-1 1 ); 

maintaining a sum of values associated with said predetermined expressions found 
within each category (Col. 3 line 65 - Col. 4 line 3); 

storing the remaining data if the sum of values associated with said predetermined 
expressions present within a category exceeds a threshold value (Col. 5 lines 47-64 and 
Col. 6 lines 29-34). 

28. With respect to Claim 57, Russell-Falla teaches all the limitations of Claim 55 and 
further teaches the threshold value for a category is defined as the presence of no 
predetermined expressions (Col. 5 lines 47-64). 

29. With respect to Claim 58, Russell-Falla teaches all the limitations of Claim 55 and 
further teaches the computer network is a wide area network (Col. 1 lines 37-45). 

30. With respect to Claim 61 , Russell-Falla teaches all the limitations of Claim 55 and 
further teaches outputting a report relating to the presence of predetermined expressions 
whose sum meets or exceed the threshold value of a category (Col. 6 lines 29-34). 

31 . With respect to Claim 62, Russell-Falla teaches all the limitations of Claim 61 and 
further teaches said report identifies individuals whose use of the computer network 
included communications which contained predetermined expressions whose sum matched 
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or exceeded the threshold value of at least one category (Col. 6 line 29-34, note the 
functionality of the report in Russell-Falla is tied to a user - Col. 6 lines 15-21). 

32. With respect to Claim 63, Russell-Falla teaches all the limitations of Claim 61 and 
further teaches said report identifies network addresses where communications were 
received or originated that included predetermined expressions whose sum matched or 
exceeded the threshold value of at least one category (Col. 6 line 29-34). 

33. With respect to Claim 64, Russell-Falla teaches all the limitations of Claim 63 and 
further teaches said report is in a graphical format (Col. 6 lines 29-34 and Col. 9 lines 1-8). 



Claim Rejections - 35 USC § 103 

34. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

35. Claims 1 -4, 6, 7, 1 1 -1 3, 1 5-21 , 23, 27-29, 32, 33 and 65-67 are rejected under 35 
U.S.C. 103(a) as being unpatentable over U.S. Patent 6,266,664 by Russell-Falla et al. 
(Russell-Falla) in view of U.S. Patent 6,453,345 by Trcka et al. (Trcka). 

36. With respect to Claim 1 , Russell-Falla teaches in a computer network, a method of 
maintaining an acceptable use policy (Col. 1 lines 26-34) comprising: monitoring TCP/IP 
network communications wherein each network communication comprises multiple half 
sessions (It is inherent that any network communication data on a network such as the 
Internet/Web -Col. 4 line 61 - Col. 5 line 21 and Col. 1 lines 37-45 - would comprise multiple 
half sessions of TCP/IP communications); storing at least some of said half sessions (Col. 5 
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line 1-4); testing the stored communication for the presence of at least one preselected 
criterion (Col. 5 lines 5-12), wherein the preselected criterion is defined by a user (Col. 4 
lines 4-13 and Col. 6 lines 49-64 and Col. 7 lines 16-29); deleting the communication if the 
presence of said at least one preselected criterion is not determined (it is inherent that the 
communication will be forwarded to the web browser and deleted from testing function of 
the proxy server when the presence is not determined - Col. 5 lines 1-14 and lines 47-65); 
and storing the communication if the presence of said at least one preselected criterion is 
determined (Col. 6 lines 29-34 and Col. 9 lines 1-8). 

Russell-Falla does not explicitly disclose storing half sessions on disk even when the 
communication does not conform to a known protocol. Trcka teaches monitoring and 
capturing all raw network data packets (Col. 6 lines 1-25). Since all raw network data 
packets are captured, this would include those of unknown protocol. These raw network 
data packets are stored on disk (Col. 7 lines 13-27). By capturing raw network data 
packets, the invention of Trcka is capable of monitoring network communications at any 
network layer including any protocol functioning at that layer (Col. 7 lines 28-41, Col. 7 line 
49 - Col. 8 line 4 and Col. 18 lines 15-29). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to take the method disclosed by Russell-Falla and modify it as indicated by Trcka 
such that the method further comprises storing at least some of said half sessions on disk, 
even when the communication does not conform to a known protocol. One would be 
motivated to have this, as it beneficial to network analysis and troubleshooting tasks and is 
further advantageous over existing network security systems (Col. 1 line 41 - Col. 2 line 9 
and Col. 2 lines 49-65 of Trcka). 
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37. With respect to Claim 2, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 1 and further teaches the preselected criterion comprises one or more subject matter 
categories (Col. 4 lines 45-60 of Russell-Falla). 

38. With respect to Claim 3, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 2 and further teaches at least some of said subject matter categories comprise 
regular expressions (Col. 3 lines 1-5 of Russell-Falla). 

39. With respect to Claim 4, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 3 and further teaches said regular expressions are weighted (Col. 3 lines 1-9 of 
Russell-Falla). 

40. With respect to Claim 6, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 2 and further teaches the preselected criterion is weighted (Col. 3 lines 1-9 of 
Russell-Falla). 

41 . With respect to Claim 7, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 4 and further teaches said regular expressions are weighted with either positive or 
negative values (Col. 3 line 60 - Col. 4 line 3 of Russell-Falla). 

42. With respect to Claim 12, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 1 and further teaches the computer network is a wide area network (Col. 1 lines 37- 
45 of RusselUFalla). 

43. With respect to Claim 13, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 1 and further teaches the computer network is a local area network (Col. 5 lines 50- 
67 of Trcka). 
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44. With respect to Claim 15, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 2 and further teaches said subject matter categories comprise key words (Col. 3 lines 
1-9 of Russell-Falla). 

45. With respect to Claim 17, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 2 and further teaches assigning a threshold value to each subject matter category 
(Col. 5 lines 47-64 of Russell-Falla). 

46. With respect to Claim 18, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 17 and further teaches at least some of said subject matter categories comprise one 
or more predetermined expressions (Col. 3 lines 36-51 of Russell-Falla). 

47. With respect to Claim 19, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 18 and further teaches assigning a value to said predetermined expressions (Col. 3 
lines 59-66 of Russell-Falla). 

48. With respect to Claim 20, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 19 and further teaches summing the values of said predetermined expressions (Col. 
3 line 60 - Col. 4 line 3 of Russell-Falla). 

49. With respect to Claim 21 , Russell-Falla in view of Trcka teaches all the limitations of 
Claim 20 and further teaches said communication is further stored if the sum of values of 
said predetermined expressions comprising a subject matter category equal or exceed the 
threshold value assigned to said subject matter category (Col. 5 lines 47-64 and Col. 6 lines 
29-34 of Russell-Falla). 

50. With respect to Claim 23, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 21 and further teaches said threshold values assigned to said subject matter 
categories are variable (Col. 5 liens 47-64 of Russell-Falla). 
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51 . With respect to Claim 27, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 1 and further teaches outputting a report relating to the presence of said at least one 
preselected criterion (Col. 6 lines 29-34 of Russell-Falla). 

52. With respect to Claim 28, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 27 and further teaches said report identifies individuals whose use of the computer 
network included communications which matched preselected criterion (Col. 6 line 29-34, 
note the functionality of the report in Russell-Falla in view of Trcka is tied to a user - Col. 6 
lines 15-21 of Russell-Falla). 

53. With respect to Claim 29, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 27 and further teaches said report identifies network addresses where 
communications were received or originated that included matched preselected criterion 
(Col. 6 lines 29-34 of Russell-Falla). 

54. With respect to Claim 32, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 27 and further teaches said report provides the text of all communications that match 
said preselected criterion (Col. 6 lines 29-34 of Russell-Falla). 

55. With respect to Claim 33, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 27 and further teaches said report is human readable format (Col. 6 lines 29-34 of 
Russell-Falla). 

56. With respect to Claim 65, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 1 and further teaches wherein at least one stored half session comprises a plurality of 
independent parts, and the testing is performed individually on each independent part (In 
Trkca: Col. 12 line 65 - Col. 13 line 49 and Col. 6 lines 1-25). 
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57. With respect to Claim 66, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 65 and further teaches wherein the independent parts comprise individual emails (In 
Russell-Fall: Col. 8 lines 51-60) and (In Trcka: Col. 14 line 61 - Col. 15 line 9). 

58. With respect to Claim 67, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 65 and further teaches wherein the independent parts comprise message 
attachments (In Russell-Fall: Col. 8 lines 51-60) and (In Trcka: Col. 14 line 61 - Col. 15 line 
9). 

59. Claims 30 and 31 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Russell-Falla in view of Trcka. 

60. With respect to Claim 30, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 2 and further teaches outputting a report relating to the presence of preselected 
criterion (Col. 6 lines 29-34 and Col. 9 lines 1-8 of Russell-Falla). 

Russell-Falla in view of Trcka does not explicitly disdose the report identifying the 
number of matches in a category. However, it is implied by Russell-Falla in view of Trcka 
that the report would indicate the number matches in a category as suggested by the 
alternate embodiments which provide for filing references of the content of concern and 
storing a presentation schema (Col. 8 line 30 - Col. 9 line 15 of Russell-Falla), 
Furthermore, the reviewer such as the administrator (Col. 6 lines 29-34 of Russell-Falla) 
would need some indication as to the significance of the report in terms of evaluating the 
content. 

Therefore it would have been obvious to one of ordinary skill in the art at the time the 
invention was made to take the method disclosed by Russell-Falla in view of Trcka and 
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modify it such that said report identifies the number of matches in a category. One would 
be motivated to have this as there is need for monitoring what persons such as employees 
access through a computer network (Col. 2 lines 24-44 of Russell-Falla). 

61 . With respect to Claim 31 , Russell-Falla teaches all the limitations of Claim 30 and 
further teaches said report is in a graphical format (Col. 6 lines 29-34 and Col. 9 line 1-8 of 
Russell-Falla). 

62. Claims 36, 51 and 59 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Russell-Falla. 

63. With respect to Claim 36, Russell-Falla teaches all the limitations of Claim 34. While 
Russell-Falla does not explicitly state the computer network is a local area network, Russell- 
Falla does state the invention is well suited for monitoring those who have managerial 
responsibility for material accessed or retrieved by others such as employees (Col. 2 lines 
30-36). This implies the computer network environment would include a local area network 
such as those associated with work environments. 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to take the method disclosed by Russell-Falla and modify it such that the 
computer network is a local area network. One would be motivated to have this as there is 
need for monitoring what persons such as employees access through a computer network 
(Col. 2 lines 24-44). 

64. With respect to Claim 51 , Russell-Falla teaches all the limitations of Claim 34 and 
further teaches outputting a report relating to the presence of predetermined expressions 
(Col. 6 lines 29-34 and Col. 9 lines 1-8). 
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Russell-Falla does not explicitly disclose the report identifying the number of 
matches in a category. However, it is implied by Russell-Falla that the report would indicate 
the number matches in a category as suggested by the alternate embodiments which 
provide for filing references of the content of concern and storing a presentation schema 
(Col. 8 line 30 - Col. 9 line 15). Furthermore, the reviewer such as the administrator (Col. 6 
lines 29-34) would. need some indication as to the significance of the report in terms of 
evaluating the content. 

Therefore it would have been obvious to one of ordinary skill in the art at the time the 
invention was made to take the method disclosed by Russell-Falla and modify it such that 
said report identifies the number of matches in a category. One would be motivated to 
have this as there is need for monitoring what persons such as employees access through 
a computer network (Col. 2 lines 24-44). 

65. With respect to Claim 59, Russell-Falla teaches all the limitations of Claim 55. While 
Russell-Falla does not explicitly state the computer network is a local area network, Russell- 
Falla does state the invention is well suited for monitoring those who have managerial 
responsibility for material accessed or retrieved by others such as employees (Col. 2 lines 
30-36). This implies the computer network environment would include a local area network 
such as those associated with work environments. 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to take the method disclosed by Russell-Falla and modify it such that the 
computer network is a local area network. One would be motivated to have this as there is 
need for monitoring what persons such as employees access through a computer network 
(Col. 2 lines 24-44). 
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66. Claims 8-10, 14, 22 and 24-26 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Russell-Falla in view of Trcka and in further view of U.S. Patent 
6,366,910 by Rajaraman et al. (Rajaraman). 

67. With respect to Claim 8, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 7 but does not explicitly disclose regular expressions with negative values being 
before regular expressions with positive value. Rajaraman teaches regular expressions 
with negative values are before regular expression with positive values (Col. 7 lines 37-45 
and Col. 9 lines 19-28). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to take the method disclosed by Russell-Falla in view of Trcka and modify it as 
indicated by Rajaraman such that regular expressions within a subject matter category 
having a negative value are before regular expressions having a positive value. This aids in 
accurately identifying the content by reducing irrelevant hits (Col. 7 lines 22-42 of 
Rajaraman). One would be motivated to have this as there is need for accurately and 
efficiently identifying a category for which content belongs (Col. 2 lines 19-56 of Russell- 
Falla). 

68. With respect to Claim 9, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 4 but does not explicitly disclose prioritizing the order which regular expressions 
within a subject matter category are tested. Rajaraman teaches prioritizing the order which 
regular expressions within a subject matter category are tested (Col. 9 lines 19-28). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to take the method disclosed by Russell-Falla in view of Trcka and modify it as 
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indicated by Rajaraman such that it further comprises prioritizing the order which regular 
expressions within a subject matter category are tested. This aids in accurately identifying 
the content by reducing irrelevant hits (Col. 7 lines 22-42 of Rajaraman). One would be 
motivated to have this as there is need for accurately and efficiently identifying a category 
for which content belongs (Col. 2 lines 19-56 of Russell-Falla). 

69. With respect to Claim 10, Russell-Falla in view of Trcka and in further view of 
Rajaraman teaches all the limitations of Claim 9 and further teaches said prioritizing 
reduces likelihood of false hits (Col. 7 lines 22-42 of Rajaraman). 

70. With respect to Claim 14, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 2 and further teaches preselected criterion (Col. 3 lines 1-8) and a plurality of 
categories (Col. 4 lines 45-60). 

Russell-Falla in view of Trcka does not explicitly disclose a presence being a match 
in a plurality of categories. Rajaraman teaches the presence being a match in a plurality of 
categories (Col. 10 lines 22-34). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to take the method disclosed by Russell-Falla in view of Trcka and modify it as 
indicated by Rajaraman such that the presence of the preselected criterion in at least one of 
said categories comprises a match in a plurality of categories. One would be motivated to 
have this as there is need for accurately and efficiently identifying a category for which 
content belongs (Col. 2 lines 19-56 of Russell-Falla). 

71 . With respect to Claim 22, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 21 and further teaches threshold values for subject matter categories (Col. 5 lines 47- 
63) and a plurality of subject matter categories (Col. 4 lines 45-60). Russell-Falla in view of 
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Trcka does not explicitly disclose a threshold for one category equaling or exceeding 
the threshold value in a plurality of categories. Rajaraman teaches a threshold for one 
category equaling or exceeding the threshold value in a plurality of categories (Col. 10 lines 
22-34). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to take the method disclosed by Russell-Falla in view of Trcka and modify it as 
indicated by Rajaraman such that the threshold value of at least one subject matter 
category comprises equaling or exceeding the threshold value in a plurality of categories. 
One would be motivated to have this as there is need for accurately and efficiently 
identifying a category for which content belongs (Col. 2 lines 19-56 of Russell-Falla). 

72. With respect to Claim 24, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 18 but does not explicitly disclose the subject matter categories having a hierarchical 
relationship. Rajaraman teaches that subject matter categories can have a hierarchical 
relationship (Col. 10 lines 22-34). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to take the method disclosed by Russell-Falla in view of Trcka and modify it as 
indicated by Rajaraman such that said subject matter categories have a hierarchical 
relationship. One would be motivated to have this as there is need for accurately and 
efficiently identifying a category for which content belongs (Col. 2 lines 19-56 of Russell- 
Falla). 

73. With respect to Claim 25, Russell-Falla in view of Trcka and in further view of 
Rajaraman teaches all the limitations of Claim 24 and further teaches said hierarchical 
relationship comprises defining the threshold value for at least one subject matter category 
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as the presence of predetermined expressions in a plurality of other subject matter 
categories (Col. 10 lines 22-34 of Rajaraman). 

74. With respect to Claim 26, Russell-Falla in view of Trcka and in further view of 
Rajaraman teaches all the limitations of Claim 24 and further teaches said hierarchical 
relationship comprises defining the threshold value for at least one subject matter category 
as matching or exceeding the threshold value assigned to a plurality of other subject matter 
categories (Col. 10 lines 22-34 of Rajaraman). 

75. Claims 40-43, 45, 46 and 56 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Russell-Falla in view of Rajaraman. 

76. With respect to Claim 40, Russell-Falla teaches all the limitations of Claim 39 but 
does not explicitly disclose prioritizing the order which regular expressions within a subject 
matter category are tested. Rajaraman teaches prioritizing the order which regular 
expressions within a subject matter category are tested (Col. 9 lines 19-28). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to take the method disclosed by Russell-Falla and modify it as indicated by 
Rajaraman such that it further comprises prioritizing the order which regular expressions 
within a subject matter category are tested. This aids in accurately identifying the content 
by reducing irrelevant hits (Col. 7 lines 22-42 of Rajaraman). One would be motivated to 
have this as there is need for accurately and efficiently identifying a category for which 
content belongs (Col. 2 lines 19-56 of Russell-Falla). 
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77. With respect to Claim 41 , Russell-Falla in view of Rajaraman teaches all the 
limitations of Claim 40 and further teaches the negative values regular expressions are 
tested first (Col. 9 lines 19-28). 

78. With respect to Claim 42, Russell-Falla in view of Rajaraman teaches all the 
limitations of Claim 41 and further teaches said negative and positive valued regular 
expressions are separately tested in the order of largest value to smallest value (Col. 9 lines 
19-45). 

79. With respect to Claim 43, Russell-Falla in view of Rajaraman teaches all the 
limitations of Claim 40 and further teaches said prioritizing is determined based upon 
reducing likelihood of false hits (CoL 7 lines 22-42 of Rajaraman). 

80. With respect to Claim 45, Russell-Falla teaches all the limitations of Claim 21 and 
further teaches threshold values for categories (Col. 5 lines 47-63) and a plurality of 
categories (Col. 4 lines 45-60). 

Russell-Falla does not explicitly disclose a threshold for one category meeting or 
exceeding the threshold value for a plurality of other categories. Rajaraman teaches a 
threshold for one category equaling or exceeding the threshold value in a plurality of 
categories (Col. 10 lines 22-34). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to take the method disclosed by Russell-Falla and modify it as indicated by 
Rajaraman such that the threshold value for at least one category comprises meeting or 
exceeding the threshold value in a plurality of categories. One would be motivated to have 
this as there is need for accurately and efficiently identifying a category for which content 
belongs (Col. 2 lines 19-56 of Russell-Falla). 
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81 . With respect to Claim 46, Russell-Falla teaches all the limitations of Claim 34 but 
does not explicitly disclose the threshold value of at least one category comprises meeting 
or exceeding the threshold value for at least one other category and not meeting or 
exceeding the threshold value for at least another category. Rajaraman teaches the 
threshold value of at least one category comprises meeting or exceeding the threshold 
value for at least one other category and not meeting or exceeding the threshold value for at 
least another category (Col. 10 lines 22-34). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to take the method disclosed by Russell-Falla and modify it as indicated by 
Rajaraman such that the threshold value of at least one category comprises meeting or 
exceeding the threshold value for at least one other category and not meeting or exceeding 
the threshold value for at least another category. One would be motivated to have this as 
there is need for accurately and efficiently identifying a category for which content belongs 
(Col. 2 lines 19-56 of Russell-Falla). 

82. With respect to Claim 56, Russell-Falla teaches all the limitations of Claim 21 and 
further remaining data being stored based on the sum of predetermined expressions (Col. 3 
line 56 - Col. 4 line 3). Russell-Falla does not explicitly disclose storing of the remaining 
data occurring only if the sum of predetermined expressions exceeds the threshold value in 
a plurality of categories. Rajaraman teaches a threshold for a plurality of categories (Col. 
10 lines 22-34). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to take the method disclosed by Russell-Falla and modify it as indicated by 
Rajaraman such that said remaining data is stored only if the sum of predetermined 
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expressions exceeds the threshold value in a plurality of categories. One would be 
motivated to have this as there is need for accurately and efficiently identifying a category 
for which content belongs (Col. 2 lines 19-56 of Russell-Falla). 

83. Claim 68 is rejected under 35 U.S.C. 103(a) as being unpatentable over Russell- 
Falla in view of Trcka as applied to claim 1 above, and further in view of U.S. Patent 
5,850,388 by Anderson et al. (Anderson). 

84. With respect to Claim 68, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 1 but does not explicitly disclose prior to testing, attempting to identify a protocol by 
comparing the stored half session with known protocol patterns. Anderson teaches 
identifying a protocol by comparing an unknown protocol with known protocol patterns. 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to take the method disclosed by Russell-Falla in view of Trcka and modify it as 
indicated by Anderson such that the method further comprises prior to testing, attempting to 
identify a protocol by comparing the stored half session with known protocol patterns. One 
would be motivated to have this, as it is desired for effective analysis and monitoring of 
network performance (In Anderson: Col. 3 line 2-16 and Col. 4 lines 1-11). 

Response to Arguments 

85. Applicant's arguments filed 7/12/05 have been fully considered but they are not 
persuasive. 
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86. Applicant argues - lt Russell-Falla does not suggest any means by which the user 
can define expressions for use in testing as called for in original claim 1 6 and now in 
claim 34" 

a. The examiner considers the manual classification of training data that 
ultimately determines the contents of database 30 (Col. 4 lines 4-13 and Col. 6 
lines 49-64 and Col. 7 lines 16-29) to be sufficiently within the scope of 
"predetermined expressions that are defined by a user". Based on the broadest 
reasonable interpretation, the act of the user selecting training data and 
classifying it, is an act of the user defining the predetermined expressions. 

87. Applicant argues - 11 The Office action cites a portion of Russell-Falla that relates 
to scanning an HTML page for regular expressions. It appears that the entire HTML 
page is used as input for analysis, including non-language elements. Russell- Falla 
does not show or suggest any activity of removing data content that does not contain 
language elements" 

b. By scanning for regular expressions, the non-language elements are 

separated from the non-language elements. Hence, Russell-Falla teaches 
"removing data content that does not contain language-elements". 

88. Applicant argues - "Further, the Russell-Falla reference does not show or fairly 
suggest capturing data on a network comprising multiple half sessions'of TCP/IP 
network communications. . .piggy backed data is not a part of the HTML page in Russell- 
Falla, but it is a part of the captured half session in claim 34. Hence, this data will 
escape analysis in Russell-Falla, but will be subject to monitoring by the invention of 
claim 34." 
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c. Claim 34 states in part, "capturing data on a network, wherein the data 
comprises multiple half sessions". The proxy software disclosed by Russell-Falla 
analyzes a requested HTML page that is transmitted over the network (Col. 4 lin 
61 - Col. 5 line 4). The HTML page is sent as data over the network, and the 
proxy software intercepts such data in order to analyze the request page. The 
examiner considers this to be sufficiently within the scope of "capturing data on a 
network". Furthermore, as the network includes the Internet/World Wide Web 
(Col. 4 line 61 - Col. 5 line 21 and Col. 1 lines 37-45), the HTML page data will be 
transmitted based on TCP/IP and will thus inherently include multiple half 
sessions. Therefore, Russell-Falla teaches "capturing data on a network, 
wherein the data comprises multiple half sessions". 

89. Applicant argues - "Russell-Falla does not show or suggest the use of categories 
nor maintaining a sum of values on a category basis as called for in claim 34. The 
amendments to claim 34 are believed to clarify the use of multiple categories in claim 
34. The Office action asserts that Russell-Falla does not prohibit multiple categories. 
However, this is far different from actually teaching multiple categories and the 
particular act of maintaining a sum of values on a category basis called for in claim 34. 
Russell-Falla must positively teach, not just fail to prohibit, this feature of claim 34 to 
form a rejection under 35 U. S. C. 102. For at least these reasons claim 34 is allowable 
over Russell Falla" 

And also "These features of claim 55 are not shown or suggested in the relied on 
reference. As noted hereinbefore and admitted in the Office action, Russell-Falla does 
not teach plural categories. Applicant maintains the position that Russell-Falla teaches 
away from using multiple categories. Moreover, if one were to modify Russell-Falla as 
suggested in the Office action, one might, by happenstance or invention, come up with 
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the solution called for in claim 55. However, that solution is not taught or suggested by 
the reference itself" 

d. The overall point of the examiner's response was that Russell-Falla states 

multiple categories (Col. 4 lines 45-60) and does not give any indication that analysis 
according to one category would prohibit the analysis according to another. 
Nowhere in Russell-Falla, is there an indication or suggestion that one making and 
using the invention of Russell-Fall would be restricted to analysis and detection of 
content in only one category. Based on the teachings and most importantly, the 
underlying principles of the invention (Col. 9 lines 9-12) of Russell-Falla, one of 
ordinary skill in the art would easily understand and anticipate that the analysis and 
detection process disclosed by Russell-Falla could be repeated on the same set of 
data for any selected category. Obviously, if one is concerned about the various 
forms of data that can be encountered in a information network environment (Col. 2 
lines 24-36), then one would not restrict or limit the detection process to a single 
form (a single category). 

e. In regards to the "maintaining a sum of values", Col. 3 line 65 - Col. 4 line 3 
states in part, "Thus, when the weightings are summed in calculating a rating of a 
page, the higher the value the more likely the page meets the selected 
criterion."(emphasis added). It is clear that each stated category (Col. 4 lines 45-60) 
has predetermined expressions and corresponding weightings. For these reasons, 
the Applicants arguments are not persuasive. 

f. Furthermore, the previous office actions do not admit that Russell-Falla does 
not teach plural categories. 
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90. Applicant argues - "Further, claim 1 calls for storing the communication in a 
conditional manner, "if the presence of at least one preselected criterion is determined." 
Trcka teaches that all raw data packets are stored, not a process of storing some and 
deleting some as called for in claim 1 . Russell-Falla does not explicitly teach storing 
any of the communication. Accordingly, the combination of Russell-Falla and Trcka 
does not suggest the invention of claim 1 ." 

g. In Trcka all raw packets are initially stored. The functionality of Trcka is 

related to firewall security (Col. 13 lines 1-49 and Col. 19 lines 23-44). As such, 
based on the analysis of the packet, the packet may be filtered out/rejected or 
passed on to the subsequent destination. This is storing of the communication 
ins a conditional manner. Russell-Falla inherently teaches a conditional storing 
of communication (Col. 4 line 61 - Col. 5 line 35 and Co. 6 lines 16-34). It would 
be impossible to perform the operations taught by Russell-Falla without storing 
the communication is some manner. 

91 . Applicant argues - "Russell-Falla must analyze HTML pages, not network 
packets, whereas Trcka must capture network packets at a very low level. The two 
references, as taught in the references themselves, describe incompatible systems" 

h. Applicant provides no factual evidence as to how the combination of 

Russell-Falla and Trcka would be incompatible. Furthermore, In re Keller, Terry, 
and Davies, (208 USPQ 871 (CCPA 1981)), states, ""Test of obviousness is not 
whether features of secondary reference may be bodily incorporated into primary 
reference's structure, nor whether claimed invention is expressly suggested in 
any one or all of references; rather, test is what combined teachings of 
references would have suggested to those of ordinary skill in art." 
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Conclusion 

92. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

93. U.S. Patent 6,633,855 by Auvenshine "Method, system, and program for filtering 
content using neural networks" October 14, 2003. Discloses filter of network packets for 
content deemed unacceptable by a user. 

94. U.S. Patent 6,148,336 by Thomas et al. "Ordering of multiple plugin applications 
using extensible layered service provider with network traffic filtering" November 14, 
2000. Discloses filtering of undesired content through the use of plugin applications 
associated with the TCP/IP stack. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to David Lazaro whose telephone number is 571-272- 
3986. The examiner can normally be reached on 8:30-5:00 M-F. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Saleh Najjar can be reached on 571-272-4006. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 



David Lazaro 
September 26, 2005 




